For platform teams on GitHub, and the audits they answer to
Stackat reads every release note between the versions you pin and the latest, for every Helm chart, Terraform provider and container image in your repositories, and opens one GitHub issue that says exactly what to change. Fewer upgrades that break, fewer known vulnerabilities left open, and a dated record of each one for your ISO 27001 or SOC 2 audit.
Upgrade ingress-nginx 4.10.0 → 4.11.3: 2 security fixes, 1 edit
01 · THE GAP
Stackat reads all of them: the chart and the app it packages. Then it checks which notes touch a value your repository actually sets, and drops the ones about features you switched off.
02 · HOW IT WORKS
No agent in your clusters, no CI changes, nothing to configure. Stackat works from what your repositories already say.
Two minutes. Read access to the repositories you choose and permission to open issues.
Argo CD, Flux, helmfile, Kustomize, Terraform, compose files and plain manifests. Plus the values files that decide which features run where.
A verdict, a checklist with files and lines, and a pull request when nothing needs changing.
03 · THE ISSUE
A note about metrics does not matter if your values switch metrics off, in that environment.
Two years behind on Traefik? It reads every release you skipped and counts the majors you are about to cross.
Ready when the notes touch nothing of yours. A draft with the checklist when they do.
Every issue is a dated record of a known upgrade risk and how it was handled: patch management for ISO 27001, SOC 2 and NIS2.
5 releases between your pin and the latest, read in full. One touches a value your repository sets.
installCRDs is replaced by crds.enabled (breaking, 1.15.0)
Do: set crds.enabled: true and crds.keep: true
Where: apps/prod/cert-manager/values.yaml:7
Illustrative example. Real issues link every file, line and release.
04 · COMPLIANCE
ISO 27001 and SOC 2 both expect you to know about vulnerabilities in what you run and to change it in a controlled way. An outdated chart or provider is exactly what an audit finds. Every Stackat issue is the record: the known risk, the fix, when it was raised and when it was done, kept in GitHub next to the code.
Security fixes in releases you have not taken yet are listed per repository, with their advisory IDs and links.
ISO 27001 A.8.8 · SOC 2 CC7.1Each upgrade is an issue and, when you want one, a pull request: what changes and why, reviewed and merged in your normal flow.
ISO 27001 A.8.32 · SOC 2 CC8.1No spreadsheet of versions to keep up to date. The record builds itself as your team works and closes when the pin reaches the latest release.
NIS2 Article 21Stackat supplies evidence for these controls. Certification still depends on your whole management system.
Missing one? Stackat notices public charts and providers it does not follow yet. The ones most teams use are added first.
05 · PRIVACY BY DESIGN
Files are scanned in a temporary folder and deleted minutes later.
The model only reads public release notes, once per release. Your configuration never reaches it.
Organisation, repository and user names are stored only as pseudonyms. The real names are sealed with a key kept offline.
Run from Croatia by people who do ISO 27001, SOC 2 and NIS2 compliance for a living. A DPA is ready to sign.
06 · UPGRADE FEED PROTOCOL
Every release Stackat reads is published through UFP, an open protocol: breaking changes, prerequisites, deprecations and a risk score as JSON. Wire it into CI, Backstage or your own agents.
Read the spec and request a key07 · PRICING
A monorepo or a hundred repositories: the same price. No seats, no per-repository maths.
For a handful of platform teams who want it first and will tell us where it is wrong.
Starts with a 14-day trial of everything, no card needed. Tell us about your setup and we will tailor it to you.
Read access to the repositories you choose and permission to open issues. Pull requests need write access to contents and pull requests, and stay off until you turn them on.
No. The model summarises public release notes once per upstream release. Comparing them with your repositories is plain code on our servers.
One issue per tool, updated as new releases come out and closed when you reach the latest. Reply /stackat ignore to silence a tool.
Yes. Deployments, StatefulSets, CronJobs, Kustomize image overrides and compose files are read too. An image pinned to latest gets a note asking for a version tag.
It gives you evidence for vulnerability and change management: every known risk in the tools you run, the fix, and when it was raised and resolved, as GitHub issues and pull requests your auditor can read. It does not replace the rest of your management system.
GitHub today. GitLab is planned; tell us if you need it and it moves up the list.
Free for early adopters. Tell us a little about your setup and we will get back to you within two working days.
You apply here. It takes a minute.
We reply with the install link and a short call if you want one.
Your first issues arrive after the first scan.